return Token

The return token contains the return status of the system
call (u_error) and the process return value (u_rval1).
The token has three fields: a token ID that identifies this token as a return token, the error status of the system call, and the system call return
value. This token is always returned as part of kernel-generated audit records for
system calls. The token indicates exit status and other return values in application
auditing. Figure A-21 shows a return token.